Oracle JDeveloper EUVD-2026-46768

Exploitation requires network-level HTTP access to an Oracle JDeveloper instance running version 12.2.1.4.0 or 14.1.2.0.0 with the Data Visualization Tools component active. The CVSS AC:H metric indicates that high attack complexity must be overcome - the exact nature of this complexity is not detailed in the advisory, but typically in Oracle CVEs this reflects a race condition, specific environmental state, or non-trivial request crafting requirement. No authentication is required (PR:N, UI:N per CVSS), but the high complexity meaningfully reduces the practical exploitability. Exploitation is further limited to environments where JDeveloper's HTTP listener is network-accessible to the attacker, which is atypical for a local developer IDE deployment. Impact is confined to read access to a subset of JDeveloper-accessible data - no code execution, no write access.

The real-world risk is low. The CVSS 3.1 base score of 3.7 is corroborated by three converging signals: AC:H indicates that exploitation is not straightforward and requires non-standard conditions to be met; the impact is limited exclusively to confidentiality (C:L), with no integrity or availability consequences; and scope is unchanged (S:U), meaning a successful exploit cannot pivot to other system components. No EPSS data was provided, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The 'Authentication Bypass' tag creates a superficial tension with the low severity - bypass of authentication sounds alarming, but the constrained confidentiality impact and high complexity indicate the bypass yields only limited data exposure, not privileged command execution. This is not a prioritization candidate for most organizations unless JDeveloper instances are internet-exposed, which is atypical for a developer IDE.

An unauthenticated remote attacker with HTTP access to a JDeveloper instance satisfies the high-complexity preconditions (likely a specific timing, configuration, or request sequencing requirement) to interact with an insufficiently protected DVT endpoint. The attacker retrieves a limited subset of data accessible to JDeveloper - such as project metadata or data source configuration fragments - without presenting valid credentials. No public proof-of-concept code exists at time of analysis.